mod_php is an older way of running PHPPHP is a programming language that builds your web pages on the computer that hosts your site, just before they reach the visitor. WordPress runs on it., in which PHP is built into Apache, the program that answers visitors, instead of running as a separate helper. It is one of the oldest ways to run PHP on the web, and it is still found on many servers, so it may be what your host uses.
What is mod_php?
mod_php is an Apache module, which means PHP runs inside the Apache web server process itself.
When Apache is configured with mod_php, the PHP interpreter is loaded into the web server. A request for a PHP page is handled in the same process that serves files, with no hand-over to another service. That is simple to set up, which is why it was the default on many hostingWeb hosting is the service that keeps your website's files on a computer that is always online, so visitors can open your site at any time. platforms for a long time.
The alternative is PHP-FPMPHP-FPM is a helper on your hosting that runs your site's PHP code as a separate job and hands the finished page back to the program that answers visitors., where PHP is a separate service and the web serverA web server is the program, such as Apache, Nginx or LiteSpeed, that answers when a visitor opens your site and sends back the page and files. forwards requests to it. With mod_php, PHP and the web server share one process and one set of permissions. That makes it harder to separate sites on one server and harder to give each site its own limits.
Why this matters for security
Because PHP lives inside the web server, a problem in PHP is a problem in the web server process. That is not a flaw in mod_php as such, but it shapes how serious a PHP vulnerabilityA vulnerability is a weakness in software that an attacker can use to do something the software was never meant to allow, such as reading private data. can be on this setup.
mod_php and the October 2026 vulnerabilities
On October 21, 2026, the PHP project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 for two critical vulnerabilities. According to php.net they can allow unauthenticated remote code execution, so an RCERemote code execution (RCE) means an attacker can make the computer that hosts your site run their own commands from afar. It is among the most serious flaws. that needs no login. php.net names all PHP installations serving web requests as at risk and considers the risk highest for mod_php. It mentions a demonstrated exploitAn exploit is a piece of code or a method that turns a software weakness into a real attack. A proof of concept only shows that the attack works., a proof that the attack works, in which an unauthenticated request triggers the attack before any application code runs.
php.net and CISA have not reported exploitation in the wild. The current facts, with timestamps, are on the PHP2Shell page.
How to check your handler
Open a phpinfo page and look at “Server API”. “Apache 2.0 Handler” means mod_php. “FPM/FastCGI” means PHP-FPM. Your hosting control panelA hosting control panel, such as cPanel, Plesk or DirectAdmin, is the web page where you manage your domain, email, databases and PHP version. often shows the same under the PHP settings. If you cannot find it, ask your host.
Then check the exact PHP versionA PHP version is a numbered edition of PHP, like 8.3. Each edition is looked after for a limited time, then gets security fixes only, then nothing., including the patchA security patch is a software update that closes one known security weakness and adds nothing else, so installing it protects you against that problem. number. The setup changes how the risk looks, but the fix is the same: a patched version. Write down both the handler and the version before you contact your host, so the conversation starts with facts instead of guesses, and ask them to confirm in writing which version is active for your domainA domain name is the address people type to reach your website, such as yourcompany.com. It points visitors to wherever your site is hosted. after the update.
When to act
If you are on mod_php and the branch you use has a fixed release, update now and ask your host when they roll it out. If your host runs an older branch, ask what they can offer. Our PHP upgrade service takes your site to a supported version, and if your host cannot help, a PHP migration service can move the site to a host that can.
Frequently asked questions
What is the difference between mod_php and PHP-FPM?
mod_php runs PHP inside the Apache process itself. PHP-FPM runs PHP as a separate service and the web server passes requests to it.
Do I use mod_php?
Your hosting panel or a phpinfo page tells you. If the Server API shows Apache 2.0 Handler, PHP runs as an Apache module. If it shows FPM/FastCGI, it does not.
Is mod_php affected by the October 2026 PHP vulnerabilities?
php.net names Apache with mod_php among the installations at risk and considers the risk highest for mod_php. It also mentions a demonstrated exploit, which is a proof that the attack works. php.net and CISA have not reported exploitation in the wild.
Should I switch from mod_php to PHP-FPM?
That is a hosting decision. The first step is to update PHP to a fixed version. Whether to change handler afterwards depends on your server and your traffic.